When configured as a server, CodeMeter Runtime versions older than 8.41a (in the 8.x series) and 9.10 (in the 9.x series) accept network requests that include opcode 0x5e. That opcode carries a data length field followed by a data payload. The runtime code fails to validate that the data length does not exceed the available buffer, resulting in an out‑of‑bounds read and a segmentation fault that terminates the runtime. The primary impact is a loss of availability; the application that depends on CodeMeter Runtime would stop functioning until the service is restarted. No direct disclosure of secrets or hijacking of execution is described, so confidentiality and integrity are not affected.

This vulnerability affects the Wibu‑Systems CodeMeter Runtime product. Specifically, all versions prior to 8.41a in the 8.x line and those prior to 9.10 in the 9.x line are impacted. Any system that runs the runtime in server mode and exposes it to network traffic is at risk.

The CVSS score of 7.5 indicates moderate severity, reflecting a significant disruption to service. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no widespread exploitation at the time of analysis. The vulnerable opcode is used in the server mode, so the attack vector is inferred to be remote over the network, as the server listens for external requests. An attacker would craft a malformed request with an oversized length field to trigger the crash, but would not gain code execution or data disclosure. The lack of official exploitation reports indicates that the risk is primarily the potential for DoS by a savvy attacker who can reach the server endpoint.